OpenCourser brand icon
Sign in
We may earn an affiliate commission when you visit our partners.

Mastering Palo Alto Networks

Packt Publishing

Network security is not a choice; it’s a must. Palo Alto Networks is one of the top firewall platform choices when it comes to protecting and securing all your critical on-premise and cloud infrastructures. That said, it’s highly probable that you—as a Network Security Engineer—is or will be managing or deploying one in your own or your customers’ environments.

Read more

Network security is not a choice; it’s a must. Palo Alto Networks is one of the top firewall platform choices when it comes to protecting and securing all your critical on-premise and cloud infrastructures. That said, it’s highly probable that you—as a Network Security Engineer—is or will be managing or deploying one in your own or your customers’ environments.

This training guide will help you fully understand what tools, features, and options your Palo Alto firewalls can offer to protect and enhance visibility in your network traffic. It has been developed by someone who understands that learning every possible aspect of a technology platform can consume precious time.

Why is this course perfect for you? It will get you from zero to hero in no time, so you can take full advantage of all of the features that the Palo Alto firewall platform has to offer. From initial policy configurations to configuring Nat and security rules to performing Active-Active highly available clusters, you’ll learn all there is required to set it up like a pro.

After completing this training guide, you’ll feel confident that you can take full advantage of all of the features of Palo Alto firewall and most importantly, keep the bad guys out of your network.

About the Author

Rene Cardona is a Network Solutions Architect with over 8 years of experience in core data centers and security infrastructure designs, architecture, consulting, and implementations. He has performed many security and data center architecture refreshes for major U.S. corporations in the logistics, retail, healthcare, and education fields.

He has provided expert insights during migrations from firewall platform vendors such as Palo Alto, Cisco, Fortinet, and Checkpoint. His vast proficiency experience ranges from Hyper-Converged Datacenter Environments He is currently in charge of securing one of the biggest shipping container terminals in the United States.

Enroll now

What's inside

Learning objectives

  • Implement palo alto ngfw profiles and policies such as url filtering, app-id, antivirus and dos to leverage palo alto's stateful security protection
  • Enable ipsec tunnel based vpns and ssl-vpn configurations (globalprotect vpn) for a cost-effective and scalable remote connectivity solution
  • Configure dynamic and static routing process in palo alto's virtual routers and configure network address translations
  • Multi-tenant or multi-context deployment scenarios providing logical segmentation between virtual firewall instances in a traffic and control-plane standpoint
  • Highly available active-active and active-standby configurations to provide always-on redundant firewall policing, inspection and routing services
  • Enable load balancing and floating virtual ips to leverage hardware resources and scale the firewall network architecture
  • Perform day-to-day firewall monitoring and maintenance tasks such as firewall updates, pan-os firewall upgrades, and backup and recovery procedures
  • Integrate palo alto firewalls into panorama for central firewall management operations

Syllabus

Getting Started in PAN-OS 8

This video will give you an overview about the course.

This video will introduce you to the Palo Alto Networks Operating System version 8 (PAN-OS 8) web graphical user interface. It will also provide the end user, web management interface familiarity, with navigation through tools and settings.

   •  Review dashboard tab and object tab

   •  Analyze the policy tab, network tab, and device tab

   •  Explore ACC tab and monitor tab

Read more

This video reviews the PAN-OS 8. 1.0 home dashboard. It guides on how to customize the dashboard in favor of the firewall administrator’s benefit, and interpreting system logs and adding widgets to the dashboard.

Guided tour to the available functions inside the console interface. Retrieving information, performing troubleshooting steps, and maintenance tasks, from the console interface.

   •  Show commands to query information, not shown on the GUI

   •  Request to execute various administration commands

   •  Use test to perform fast troubleshoot steps

An overview on how we can effectively delegate and control access to a management interface. Also, shows how to provide management attributes to an interface and delegate custom rights to local administrators.

   •  Review the physical interface location

   •  Configure a management profile

   •  Configure an administrator role for management purposes

Test Your Knowledge
Firewall Objects: Addresses, Services, and Groups

This video explains in detail how to take advantage in creating and applying address objects and groups to structure a clean and precise security policy table.

   •  Create an address object

   •  Create an address group

   •  Consolidate address objects into their respective groups

This has a detailed explanation on how to take advantage in applying service objects and groups on the firewall security policy table, and how it allows concise policy structure format and standardization.

   •  Create a service object

   •  Create a service object group

   •  Nest service object group to shrink the policy table

This section explains in detail how to profile the traffic by creating application objects and classify them in groups.

   •  Create an application object

   •  Create an application group

   •  Classify application objects in a group

Here we shall review Applipedia or the Application Research Center, to understand the Palo Alto network’s application objects database. Also, we shall review application object dependencies to properly configure application objects.

  • Get familiar with applipedia.paloaltonetworks.com

  • Review application objects dependencies

  • Add required dependencies for specific application groups

This explains how to create local user accounts on the firewall, to enforce security policies, based on the local user database. Also, how to create local user groups to organize and enforce user group based policies.

   •  Create a local user account

   •  Create a local user group

   •  Add the local user on the local group and enforce security

It tells us how to integrate your Palo Alto firewall with LDAP, to enforce directory service-based user account security policies.

   •  Perform LDAP integration with service account

   •  Perform LDAP user group mapping

   •  Create security groups with LDAP security groups

We shall configure a source address translation that will allow internal users reach the outside zone (Internet).

   •  Create the source NAT policy

   •  Create the security policy to allow outbound access

   •  Enable the policy and test reachability to the internet, from internal user

Firewall Security Zones, Interface Types, and V-Wires

This video provides mandatory security isolation, by classifying interfaces into their respective locations on the network.

   •  Identify your perimeter networks:  outside, inside, and DMZ

   •  Create individual security zones

   •  Add respective member interfaces on each zone

This video explains various options to provide end to end connectivity between your Palo Alto firewall and your core network infrastructure.

   •  Configure Layer 2 interfaces

   •  Configure Layer 3 interfaces

   •  Configure Tunnel, Loopback, and HA interfaces

This video explains how to allow the Palo Alto firewall to enforce traffic transparently, by bridging ingress and egress interfaces, and traffic in zones, without influencing the routing path decisions.

   •  Configure the physical interfaces in V-wire mode

   •  Create a V-wire and bridging the two interfaces that were previously configured

   •  Allocate each V-wire member interface in a security zone and creating a security policy

Security Policies, Routing Contexts, and NAT

This gives us a real life work scenario introduction on how to build network security policies.

   •  Review the security rule requirements

   •  Create required objects

   •  Configure the required security policy

Applying security policies based on application and user attributes.

   •  Identify the user or application to grant/restrict traffic

   •  Create required application/user objects

   •  Configure the required security policy

This video will review our first virtual router deployment and enable traffic flow on the virtual instance.

   •  Create the virtual router (VRTR) for internet access

   •  Identify the user traffic that will be granted internet access

   •  Apply the route on the virtual router and enable access to the outside world

We shall see how to create a dedicated virtual router for server traffic and enable dynamic routing.

   •  Create the virtual router (VRTR) for server traffic access

   •  Configure OSPF as our dynamic routing protocol

   •  Advertise a network via OSPF, between the core and the firewall

Here, we shall configure a destination network address translation, that will allow external users reach a webserver on the DMZ.

   •  Create the destination NAT policy

   •  Create the security policy to allow inbound access

   •  Enable the NAT policy and test reachability from the user’s perspective

Next-Generation Firewall Features

General overview of all the next generation features available on the Palo Alto firewall.

   •  Discuss each security profile

   •  Demonstrate use case scenarios

   •  Explore options available inside each security profile

Apply antivirus and anti-spyware profiles to protect the environment from common threats.

   •  Review default settings on each profile

   •  Create custom profiles

   •  Apply both default and custom profiles to each respective policy

Configure URL filtering and file blocking profiles to limit user access to restricted content on the web.

  • Review default settings on each profile

  • Create custom profiles

  • Apply both default and custom profiles to each respective policy

Review and configure DoS zone protection profiles and understand the use cases.

   •  Configure DoS protection profiles

   •  Configure DoS zone protection policies

   •  Review the zone protection profile configuration

High Availability Firewall Clustering and Virtual Systems

A general overview of HA environments in Palo Alto firewalls.

   •  Active/Standby overview

   •  Active/Active overview

   •  Virtual IP overview

Enable redundancy on the PA environment with Active/ Standby HA configuration.

   •  Enable the HA interfaces

   •  Enable Active/Standby with HA Interface configurations

In this video, we will execute failover test.

   •  Configure HA interfaces

   •  Configure zones: Both, outside and inside

   •  Confirm HA is active and execute failover test

Here, we shall enable redundancy and load balancing, and maximize capacity on the PA environment with Active/Active HA configuration.

   •  Configure unique Zone IPs

   •  Configure virtual IPs and enable Active/Active HA

   •  Confirm HA is active and execute failover test

Enable Active/Active traffic load balancing with virtual IPs and failover traffic with floating IPs.

   •  Configure ARP load sharing with virtual IPs

   •  Configure floating IPs

   •  Test virtual IP reachability and failover services

Leverage hardware resources, limit complexity, and maintenance by enabling virtual systems.

   •  Enable virtual systems (vsys) under device

   •  Create virtual systems

   •  Allocate dedicated interfaces and virtual routers to the vsys

IPSec VPN Tunnels and GlobalProtect

A general overview of IPSec tunneling options and GlobalProtect.

   •  Review the IPSec site to site tunnel modes

   •  Review the GlobalProtect gateway and portal

   •  Understand the cases where we can apply either of the solutions

Enable a site-to-site IPSec tunnel in tunnel (proxy) mode and send traffic between the distant networks.

   •  Configure all prerequisites for our IPSec tunnel

   •  Configure the IPSec tunnel along with security policies

   •  Enable the tunnel and test traffic flow and reachability

Convert the IPSec tunnel into an interface mode, by configuring L3 tunnel interfaces.

   •  Configure the tunnel interfaces in L3 and allocate IPs

   •  Enable dynamic routing (OSPF) and advertise distant networks

   •  Confirm traffic reachability to the advertised networks

Enable the GlobalProtect portal and assign access groups.

   •  Configure the VPN users and users’ groups

   •  Configure the GlobalProtect portal on the outside interface

   •  Test reachability of the GlobalProtect portal and download GlobalProtect agent

Enable secure remote access to your external users by configuring a GlobalProtect gateway for VPN services.

   •  Create a GlobalProtect VPN security zone and tunnel interface

   •  Create a GlobalProtect gateway and configure the agent

   •  Configure the GlobalProtect portal agent for external gateway access

Management and Maintenance Operations

Detailed PAN-OS upgrade procedure demonstration. Base PAN-OS and Maintenance PAN-OS versions.

  • Discuss upgrade paths

  • Perform maintenance version upgrades

  • Perform base version upgrade

This will give the firewall configuration management overview and also configuration backup, restore, reverts, and audits.

  • Perform running and candidate configuration audits

  • Perform configuration backup and snapshot

  • Perform configuration reverts and restores

Perform emergency recovery procedures and troubleshooting with the maintenance recovery tool.

  • Boot the Palo Alto firewall, during boot enter “maint” when prompted

  • Restore from factory once in the maintenance mode, if needed

  • Repair disk partition corruption, if needed, using the recovery tool

We shall administer multiple geographically dispersed Palo Alto firewalls using Panorama.

  • Add devices to Panorama

  • Configure device groups in Panorama and add respective devices

  • Configure shared policies for all device groups or configure policies per device group

Good to know

Know what's good
, what to watch for
, and possible dealbreakers
Covers Active/Active high availability configurations, which are essential for maintaining network uptime and resilience in enterprise environments
Explores the integration of Palo Alto firewalls into Panorama, which is useful for centralized management of multiple firewalls in larger networks
Teaches how to configure IPsec VPN tunnels and SSL-VPN configurations (GlobalProtect VPN), which are standard for secure remote access solutions
Uses PAN-OS 8, which was first released in 2017 and has reached end-of-life; learners should be aware that this is not the latest version
Develops skills in configuring dynamic and static routing processes, which are crucial for integrating firewalls into existing network infrastructures
Taught by Rene Cardona, a Network Solutions Architect with extensive experience in security and data center architecture for major U.S. corporations

Save this course

Save Mastering Palo Alto Networks to your list so you can find it easily later:
Save

Activities

Be better prepared before your course. Deepen your understanding during and after it. Supplement your coursework and achieve mastery of the topics covered in Mastering Palo Alto Networks with these activities:
Review Networking Fundamentals
Reinforce your understanding of basic networking concepts like TCP/IP, subnetting, and routing protocols. A solid foundation will make grasping Palo Alto's implementation of these concepts much easier.
Browse courses on Networking Fundamentals
Show steps
  • Review the OSI model and its layers.
  • Practice subnetting exercises.
  • Research common routing protocols like OSPF and BGP.
Read 'The TCP/IP Guide'
Deepen your understanding of TCP/IP protocols, which are fundamental to network security. This book provides a comprehensive reference for understanding how Palo Alto firewalls interact with network traffic.
View The TCP/IP Guide: A Comprehensive, Illustrated... on Amazon
Show steps
  • Read the chapters on TCP, UDP, and IP protocols.
  • Focus on sections related to network addressing and routing.
  • Take notes on key concepts and terminology.
Configure Basic Firewall Policies in a Lab
Practice configuring basic firewall policies, NAT rules, and security zones in a lab environment. Hands-on experience is crucial for mastering Palo Alto Networks firewalls.
Show steps
  • Set up a virtualized Palo Alto firewall in a lab environment.
  • Configure security zones and interfaces.
  • Create basic security policies to allow or deny traffic.
  • Implement NAT rules for outbound internet access.
Four other activities
Expand to see all activities and additional details
Show all seven activities
Follow Palo Alto Networks Configuration Examples
Work through official Palo Alto Networks configuration examples for common scenarios. This will expose you to best practices and different configuration options.
Show steps
  • Visit the Palo Alto Networks documentation website.
  • Find configuration examples for features like VPNs, routing, and security profiles.
  • Replicate the configurations in your lab environment.
  • Test and verify the functionality of each configuration.
Design a Secure Network for a Small Business
Apply your knowledge by designing a secure network for a hypothetical small business using Palo Alto Networks firewalls. This project will test your ability to integrate various security features.
Show steps
  • Define the network requirements for the small business.
  • Design the network topology, including security zones and interfaces.
  • Configure firewall policies, NAT rules, and security profiles.
  • Document your design and configuration choices.
Write a Blog Post on a Specific Palo Alto Feature
Solidify your understanding by writing a blog post explaining a specific Palo Alto Networks feature, such as App-ID or URL Filtering. Teaching others is a great way to reinforce your own knowledge.
Show steps
  • Choose a Palo Alto Networks feature that you want to explain.
  • Research the feature and gather relevant information.
  • Write a clear and concise blog post explaining the feature and its benefits.
  • Include examples and screenshots to illustrate your points.
Contribute to a Palo Alto Networks Automation Project
Contribute to an open-source project that automates tasks related to Palo Alto Networks firewalls. This will expose you to real-world challenges and best practices in network security automation.
Show steps
  • Find an open-source project related to Palo Alto Networks automation (e.g., Ansible playbooks, Python scripts).
  • Identify a bug or feature that you can contribute to.
  • Submit a pull request with your changes.
  • Participate in code reviews and discussions with other contributors.

Career center

Learners who complete Mastering Palo Alto Networks will develop knowledge and skills that may be useful to these careers:
Network Security Engineer
A Network Security Engineer is responsible for designing, implementing, and maintaining network security infrastructure. This role requires a deep understanding of firewall technologies, like Palo Alto Networks, which is directly addressed by this course. This course provides hands-on training in configuring Palo Alto firewalls, including implementing security policies, managing network address translation, and setting up high-availability clusters. A Network Security Engineer would find that the course enables them to proficiently manage Palo Alto firewalls, protect networks from threats, and enhance network visibility.
See salaries and explore the career path for Network Security Engineer
Network Engineer
A Network Engineer designs, implements, and maintains network infrastructure. This course provides a deep dive into Palo Alto firewalls, a critical component of modern network security. The course covers a wide range of topics, including configuring virtual routers, setting up network address translation, and implementing virtual private networks. A Network Engineer will use the skills from this course to effectively manage and secure the network infrastructure.
See salaries and explore the career path for Network Engineer
Network Administrator
A Network Administrator manages an organization's network infrastructure, which often includes firewalls. This course on Palo Alto Networks will be directly relevant as it provides hands-on experience with this firewall platform. A Network Administrator will gain necessary abilities such as configuring security rules, using network address translation, and setting up virtual private networks. The course's coverage of active-active high availability configurations is particularly valuable for someone ensuring network reliability.
See salaries and explore the career path for Network Administrator
Infrastructure Engineer
An Infrastructure Engineer is in charge of maintaining and improving an organization’s IT infrastructure, which includes network security components like firewalls. This course is valuable to an Infrastructure Engineer, being a deep dive into the practical management of Palo Alto Networks firewalls. The course provides expertise in configuring and managing firewalls, including setting up security policies, implementing virtual private networks, and managing high-availability configurations. An Infrastructure Engineer would use this knowledge to maintain a reliable and secure network.
See salaries and explore the career path for Infrastructure Engineer
Security Architect
A Security Architect designs and plans an organization's overall security strategy, including infrastructure elements like firewalls. This course provides concrete skills in operating Palo Alto firewalls, demonstrating a practical understanding of security technology that complements the theoretical knowledge of a Security Architect. The course covers implementation of firewall policies, VPN configurations, and high-availability setups. A Security Architect will find that hands-on knowledge of a major firewall platform helps them make well-informed decisions when designing security infrastructure.
See salaries and explore the career path for Security Architect
Solutions Architect
A Solutions Architect designs and oversees the implementation of technology solutions to meet business needs. This course is highly relevant as it provides hands-on expertise with Palo Alto firewalls, a key technology in network security. The course covers topics that include initial policy configurations, network address translation, and high-availability configurations, all essential components when implementing network solutions. A Solutions Architect should take this course to improve their ability to design and implement secure network infrastructures.
See salaries and explore the career path for Solutions Architect
IT Security Specialist
An IT Security Specialist is responsible for the security of an organization's IT systems and infrastructure. This course is important as it provides hands-on training on a major firewall platform, Palo Alto Networks. The course covers the implementation of security policies, use of virtual private networks, and high-availability setups. An IT Security Specialist will utilize the skills from this course in order to secure network infrastructure.
See salaries and explore the career path for IT Security Specialist
Systems Administrator
A Systems Administrator manages and maintains an organization's computer systems and networks. This course helps those in system administration roles by providing specific knowledge about a crucial network security tool. The course covers configurations of Palo Alto firewalls, from initial policy setups to active-active high-availability clusters, which a Systems Administrator may encounter daily. Furthermore, the material regarding maintenance tasks, such as firewall updates and upgrades, are directly applicable to the daily operations of a Systems Administrator.
See salaries and explore the career path for Systems Administrator
Cloud Security Engineer
A Cloud Security Engineer is in charge of securing cloud-based environments. Palo Alto Networks is an important platform in cloud security, and this course helps by providing specialized skills in managing and deploying their firewalls. The course covers important concepts like configuring virtual private networks and leveraging load balancing, which are crucial for securing cloud infrastructure. A Cloud Security Engineer can utilize this knowledge to enhance security posture and safeguard cloud resources.
See salaries and explore the career path for Cloud Security Engineer
Information Security Analyst
An Information Security Analyst is responsible for protecting an organization's information assets and systems from security threats. While their focus may not be on daily firewall configuration, a thorough understanding of firewall technology provided by this course will help them. The course covers the practical aspects of Palo Alto firewalls, including security policy implementation, threat protection profiles, and VPN configurations. An Information Security Analyst can use this knowledge to better assess and address security vulnerabilities.
See salaries and explore the career path for Information Security Analyst
Security Operations Center Analyst
A Security Operations Center Analyst monitors security systems and responds to security incidents. While they do not primarily configure firewalls, understanding firewall operation as provided by this course is critical for this role. This course on Palo Alto Networks demonstrates the practical aspects of firewall management, including policy configuration and threat protection features, which helps with incident response. A Security Operations Center Analyst will benefit from this understanding by improving their ability to analyze and respond to network threats.
See salaries and explore the career path for Security Operations Center Analyst
Cybersecurity Analyst
A Cybersecurity Analyst monitors and analyzes security events to protect an organization’s digital assets. While they might not directly configure firewalls, understanding their functionality is critical. This course on Palo Alto Networks provides valuable insights into how firewalls operate, how to configure security policies, and how to leverage features like URL filtering and application identification. A Cybersecurity Analyst benefits from knowing how these tools function, which allows for better incident response and security analysis. This course may be useful to anyone hoping to improve their understanding of network security.
See salaries and explore the career path for Cybersecurity Analyst
IT Manager
An IT Manager is responsible for the overall management of an organization’s information technology resources. This course may be useful as it gives insight into the operation of network security tools. This course goes into detail about the configuration and management of Palo Alto firewalls, including setting up security policies and high-availability options. An IT Manager benefits by gaining an understanding of this technology to make informed decisions about their organization’s security infrastructure.
See salaries and explore the career path for IT Manager
Security Consultant
A Security Consultant advises organizations on how to improve their security posture. This course may be helpful because a consultant often needs to demonstrate a practical understanding of security technologies. This course offers hands-on training in configuring Palo Alto firewalls, including implementing security policies and high-availability clusters. A Security Consultant will find this experience valuable in offering well-informed and practical advice to clients.
See salaries and explore the career path for Security Consultant
Technical Support Engineer
A Technical Support Engineer provides technical assistance to users of a product or service. This course on Palo Alto Networks may be helpful as it gives practical experience with troubleshooting and configuring a major firewall platform. The course's coverage of topics such as firewall upgrades, backup, and recovery procedures, as well as its focus on troubleshooting steps from the console interface, are important for anyone in this role. A Technical Support Engineer will use the knowledge to deliver effective technical assistance.
See salaries and explore the career path for Technical Support Engineer

Reading list

We've selected one books that we think will supplement your learning. Use these to develop background knowledge, enrich your coursework, and gain a deeper understanding of the topics covered in Mastering Palo Alto Networks.
Cover image
The TCP/IP Guide
Save
Provides an exhaustive and detailed explanation of the TCP/IP protocol suite. It valuable resource for understanding the underlying protocols that Palo Alto Networks firewalls use to inspect and manage network traffic. While not specific to Palo Alto, it provides the necessary background for advanced configuration and troubleshooting. This book is best used as a reference to deepen your understanding of network protocols.
The TCP/IP Guide: A Comprehensive, Illustrated...
Hardcover
$$$
The TCP/IP Guide: A Comprehensive, Illustrated...
Kindle Edition
$$$

Share

Help others find this course page by sharing it with your friends and followers:
Facebook
LinkedIn
Reddit
X
Link
Email

Similar courses

Similar courses are unavailable at this time. Please try again later.
Effort
9 total hours
Via
Udemy
Instructor
Packt Publishing
Language
English
Good to know
Covers Active/Active high availability configurations, which are essential for maintaining network uptime and resilience in enterprise environments
Explores the integration of Palo Alto firewalls into Panorama, which is useful for centralized management of multiple firewalls in larger networks
Teaches how to configure IPsec VPN tunnels and SSL-VPN configurations (GlobalProtect VPN), which are standard for secure remote access solutions
Uses PAN-OS 8, which was first released in 2017 and has reached end-of-life; learners should be aware that this is not the latest version
Develops skills in configuring dynamic and static routing processes, which are crucial for integrating firewalls into existing network infrastructures
Taught by Rene Cardona, a Network Solutions Architect with extensive experience in security and data center architecture for major U.S. corporations
Share and help others discover this course.
Facebook LinkedIn X Reddit Link Email
Don't miss out
Enroll today to gain access to this course
Enroll in this course
Our mission

OpenCourser helps millions of learners each year. People visit us to learn workspace skills, ace their exams, and nurture their curiosity.

Our extensive catalog contains over 50,000 courses and twice as many books. Browse by search, by topic, or even by career interests. We'll match you to the right resources quickly.

Find this site helpful? Tell a friend about us.

Affiliate disclosure

We're supported by our community of learners. When you purchase or subscribe to courses and programs or purchase books, we may earn a commission from our partners.

Your purchases help us maintain our catalog and keep our servers humming without ads.

Thank you for supporting OpenCourser.

© 2016 - 2025 OpenCourser